Today, computer systems may execute a plurality of processes in a concurrent manner. Each process is granted a set of privileges at the time the process is created and these privileges may change over the life of the process. Typically, the set of privileges granted to a process is stored in a token structure associated with each process. In a computing device with a Windows® operating system, for example, each token structure is “unique” to a process within the run-time environment in that there is a one-to-one mapping between the process and its associated token (and its included privileges set), and this is established through a kernel object stored in system memory.
However, recently, exploits have been developed that seek to take advantage of vulnerabilities which enable the exploit to modify the privilege of a process and thereafter use the process for unintended purposes. Specifically, exploits may attempt to steal a token of a first process and associate a second process with the stolen token. A second exploit may involve modifying the token structure of a process to alter the set of privileges granted to the corresponding process. For example, an exploit may modify the token structure of a first process by granting the first process additional privileges that were not intended to be obtained by the process.
By the modification of the set of privileges, either by associating one process with the token of another process or by modifying the token structure of a process, the exploit may cause the process to perform unwanted or malicious behavior using the modified privileges. For example, the process having a modified set of privileges may delete or alter one or more files to which the process was not intended to have access. Additionally, a process having a modified set of privileges may open a communication line to a foreign server and download unwanted or malicious payloads. Such exploits may be referred to as exploit of privilege (EoP) attacks, or privilege escalation attacks.
A computer system manages operations performed by each process according to the set of privileges granted to each process. Therefore, when the privileges of a process have been modified, a computer system may unknowingly enable a process to perform operations that the process should be restricted from performing. Additionally, these operations may appear routine or harmless to current malware detection systems. Therefore, detection of EoP attacks present challenges to current malware detection systems.